[S] Change in openvpn[master]: Introduce get_key_by_management_key_id helper function

Attention is currently required from: flichtenheld.

plaisthos has posted comments on this change by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1856?usp=email )

Change subject: Introduce get_key_by_management_key_id helper function
......................................................................


Patch Set 6:

(1 comment)

File src/openvpn/ssl_common.h:

http://gerrit.openvpn.net/c/openvpn/+/1856/comment/af028c42_ec4c2b57?usp=email :
PS6, Line 775:             return ks;
> The old code did not abort on first match but always checked all three key states. […]
So each key_state has its own unique mda_key_id so there is only one valid key_state with mda_key_id, so the code does the same. But valid does a bit of heavy lifting here:

If state is S_UNDEF, mda_key_id is 0 and 0 is also a valid key id for the very first client. So we need to check for S_UNDEF to determine if the client actually the one with key-id 0 or just not initialised. 

As alternative we can change the initialisation of context_2  or assignment of mda_key_id_counter to start with 1 instead of 0.

E.g.

session->opt->mda_context->mda_key_id_counter++;
    ks->mda_key_id = 

E.g. something like:

    index de9303b30..478e4d314 100644
    --- a/src/openvpn/manage.h
    +++ b/src/openvpn/manage.h
    @@ -69,6 +69,8 @@ struct man_def_auth_context
     #define DAF_INITIAL_AUTH           (1u << 2)
         unsigned int flags;
     
    +    /** Identify the key id in the management interface, always 1 or
    +     * or greater if valid */
         unsigned int mda_key_id_counter;
     };
     
    diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
    index 82d7daeb2..3495f9dd7 100644
    --- a/src/openvpn/ssl.c
    +++ b/src/openvpn/ssl.c
    @@ -870,7 +870,10 @@ key_state_init(struct tls_session *session, struct key_state *ks)
         ks->crypto_options.pid_persist = NULL;
     
     #ifdef ENABLE_MANAGEMENT
    -    ks->mda_key_id = session->opt->mda_context->mda_key_id_counter++;
    +    /* Increment key ID before assigning to always have a key id >= 1 to
    +     * make 0 signify an invalid key id */
    +    session->opt->mda_context->mda_key_id_counter++;
    +    ks->mda_key_id = session->opt->mda_context->mda_key_id_counter;
     #endif
     
         /*
    diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
    index 3b326a7c1..0270c23f2 100644
    --- a/src/openvpn/ssl_common.h
    +++ b/src/openvpn/ssl_common.h
    @@ -764,7 +764,7 @@ get_primary_key(const struct tls_multi *multi)
     
     #ifdef ENABLE_MANAGEMENT
     /**
    - * Gets the \c key_state  object that belong to the management key id or
    + * Gets the \c key_state object that belongs to the management key id or
      * return NULL if not found.
      */
     static inline struct key_state *
 
 But that is a much bigger/more invasive change but I change the commit to do that as well to avoid this check here.



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1856?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I42d8785959c24bf688190965e58b9b98251b8557
Gerrit-Change-Number: 1856
Gerrit-PatchSet: 6
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Comment-Date: Wed, 26 Aug 2026 16:23:20 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: flichtenheld <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel